Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: AWS tough, tuftool — aws.amazon.com/security/security-bulletins/2026-019-aws Clear all filters
TI-2026-06100 CVE-2026-6968

Multiple Path Traversal Variants in awslabs/tough

Priority LOW 32

Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute target names in copy…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00533 Published 2026-04-24 Fixed in 0.22.0, 0.15.0 CWE-22
TI-2026-06099 CVE-2026-6967 · GHSA-4v58-8p28-2rq3

Missing Delegated Metadata Validation in awslabs/tough

Priority LOW 31

Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integ…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00253 Published 2026-04-24 Fixed in 0.22.0, 0.15.0 CWE-345
TI-2026-06098 CVE-2026-6966 · GHSA-8m7c-8m39-rv4x

Signature Threshold Bypass in awslabs/tough Delegated Roles

Priority LOW 31

Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplic…

CVSS 4.0HIGH 7.0 Network Low privileges No interaction EPSS 0.00283 Published 2026-04-24 Fixed in 0.22.0, 0.15.0 CWE-347